To prevent digital data from being illegally used by for example stealing or falsifying an encrypting technology that performs an encryption process for digital data to be transmitted has been practically used. FIG. 1 schematically shows an example of the structure that encrypts digital data. Original data for which an encryption program has not been yet performed are referred to as a plain text. When a plain text is encrypted by an encryption block 200, an encrypted text (encrypted data) is generated. When an encrypted text is decrypted by a decryption block 201, which corresponds to the encryption block 200, the encrypted text is restored to the plain text.
For example, AES (Advanced Encryption Standard) and DES (Data Encryption Standard) typify the encryption system used in the encryption block 200. The AES and DES encrypt a plain text and decrypt an encrypted text with an unpublished key referred to as a secret key. When the encryption block 200 encrypts a plain text according to the AES, the encryption block 200 encrypts the plain text with a key 202, which is a secret key. The encrypted text is supplied to the decryption block 201 through a transmission path. The encrypted text is decrypted with the key 202, which was used when the plain text was encrypted. The AES and DES are common key systems that use a common key for the encryption and decryption.
The encryption block 200 and the decryption block 201 are thought to use an encryption device 50 (or a decryption device) as an encryption circuit and a decryption circuit according to the AES or DES as shown in FIG. 2. The structure shown in FIG. 2 is referred to as an ECB mode (Electronic CodeBook mode). In the structure shown in FIG. 2, the encryption device 50 encrypts an input plain text Mi with a key (K) according to for example the AES and obtains an encrypted text Ci. In the same structure, when the encrypted text Ci is input to the encryption device 50 and the encrypted text Ci is encrypted with the key (K), the encrypted text Ci is decrypted and the original text Mi is obtained.
In the structure shown in FIG. 2, when the same plain text is successively input, the encrypted text having the same value is successively output. Thus, the key (K) can be easily decrypted in accordance with the plain text and encrypted text. To solve this problem, various techniques have been proposed.
In FIG. 3A and FIG. 3B, an output of the encryption device is fed back to an input thereof. This structure is referred to as a CBC (Cipher Block Chaining mode). In an encryption circuit 60 shown in FIG. 3A, a plain text Mi is input to an encryption device 62 through an EXOR (exclusive OR) circuit 61. The encryption device 62 encrypts the plain text Mi with a key (K). The encryption device 62 outputs an encrypted text Ci. A delay circuit 63 delays the encrypted text Ci by an initialized vector IV, for example one word, and supplies the delayed encrypted text to the EXOR circuit 61. The EXOR circuit 61 exclusively ORes the delayed encrypted text and the plain text Mi and outputs the resultant data to the encryption device 62.
FIG. 3B shows the structure of a decryption circuit 65, which corresponds to the encryption circuit 60. When an encrypted text Ci is decrypted, it is input to the encryption device 62. In addition, a delay circuit 67 delays the encrypted text Ci by an initialized vector IV, for example one word, and supplies the delayed encrypted text to an EXOR 68. The encryption device 62 encrypts the encrypted text Ci with the key (K). The EXOR 68 exclusively ORes the encrypted text Ci and the delayed initialized vector IV and obtains the original plain text Mi.
According to the structures shown in FIG. 3A and FIG. 3B, since the initialized vector IV is changed, even if the same key (K) is used, different encrypted texts Ci are generated with the same plain text Mi. Since the encrypted text Ci of which the plain text Mi has been encrypted is used as the initialized vector IV, even if the same plain text Mi is successively input, the encrypted texts Ci encrypted by the encryption device 62 do not become the same. Thus, in the CBC mode it is more difficult to decrypt an encrypted text than in the foregoing ECB mode.
FIG. 4A and FIG. 4B show structures of which a part of a generated encrypted text Ci is fed back to the input of an encryption device. These structures are referred to as a CFB (Cipher FeedBack mode). In an encryption circuit 70 shown in FIG. 4A, a plain text Mi that is input as j-bit data is supplied to an EXOR circuit 71. The EXOR circuit 71 exclusively ORes the bits and j bits of the output of an encryption device 74 and outputs an encrypted text Ci. The encrypted text Ci is supplied to a DR circuit 73 through a circuit 72 that converts j bits into k bits. The DR circuit 73 has a shift register that successively shifts k-bit data and generates for example 128-bit data Xi. The data Xi are supplied to the encryption device 74. The encryption device 74 encrypts the data Xi with a key (K) and obtains 128-bit data Yi. The data Yi are a pseudo random sequence. When the data Yi are exclusively ORed with the input plain text Mi, an encrypted text Ci is generated.
FIG. 4B shows the structure of a decryption circuit 75, which corresponds to the encryption circuit 70. An encrypted text Ci that has been input as j-bit data is supplied to a ξ circuit 76. The ξ circuit 76 converts j-bit data into k-bit data and supplies the k-bit data to a DR circuit 78. In addition, the encrypted text Ci is supplied to an EXOR circuit 77. The DR circuit 78 has a shift register. The shift register generates for example 128-bit data Xi from the supplied k-bit data and supplies the data Xi to an encryption device 79. The encryption device 79 encrypts the data Xi with the key (K) and obtains 128-bit data Yi. The data Yi are a pseudo random sequence. When the data Yi are exclusively ORed with the input encrypted text Ci, the encrypted text Ci is decrypted and the original plain text Mi is obtained.
The CFB mode is suitable for encrypting stream data of which an plain text Mi is successively input because the input plain text Mi and an encrypted text Ci are input to a shift register, the converted data are input to an encryption device, and the encryption device generates a pseudo random sequence. However, if a transmission error takes place in encrypted data that are output from the encryption circuit 75, until the shift register (DR circuit) completes one cycle, the encryption circuit 75 cannot be recovered from the error.
FIG. 5A and FIG. 5B show structures that feed back only an output of an encryption device and generate a pseudo random number. These structures are referred to as an OFB mode (Output FeedBack mode). In an encryption circuit 80 shown in FIG. 5A, an output of an encryption device 83 is input to the encryption device 83 through a DR circuit 82 that has a shift register. The encryption device 83 encrypts data Xi with a key (K). Data Yi that are output from the encryption device 83 are a pseudo random sequence. Only j bits of the data Yi are supplied to an EXOR circuit 81. The EXOR circuit 81 exclusively ORes the j bits of the data Yi and the plain text Mj that is input as j-bit data. As a result, the plain text Mi is encrypted and output as an encrypted text Ci.
FIG. 5B shows the structure of a decryption circuit 85, which corresponds to the encryption circuit 80. In the OFB mode, the structure of the decryption circuit 85 is the same as that of the encryption circuit 80. In other words, a j-bit encrypted text Ci is input to an EXOR circuit 86. On the other hand, an output of an encryption device 88 is input to the encryption device 88 through a DR circuit 87 that has a shift register. The encryption device 88 encrypts the output of the DR circuit 87 with the key (K). Data Yi that are output from the encryption device 88 are a pseudo random sequence. Only j bits of the data Yi are supplied to the EXOR 86. The EXOR circuit 86 exclusively ORes the j bits of the data Yi and the input encrypted text Ci, decrypts the encrypted text Ci, and obtains the plain text Mi.
In the OFB mode, since data are fed back in the encryption circuit 80 and the decryption circuit 85, they are not affected by a transmission error and so forth.
FIG. 6A and FIG. 6B show structures of which a counter successively counts up and outputs the count value to an encryption device. These structures are referred to as a counter mode. In other words, in the counter mode, a count value is encrypted and encrypted count value is used. In an encryption circuit 90 shown in FIG. 6A, a counter 92 counts up and outputs a count value Xi as 128-bit data to an encryption device 93. The encryption device 93 encrypts the count value Xi with a key (K). The encryption device 93 outputs data Yi that are a pseudo random sequence. Only j bits of the data Yi are supplied to an EXOR circuit 91. The EXOR circuit 91 exclusively ORes the j bits of the data Yi and the j-bit plain text Mi and generates an encrypted text Ci.
FIG. 6B shows the structure of a decryption circuit 95, which corresponds to the encryption circuit 90. In the counter mode, the structure of the decryption circuit 95 is the same as that of the encryption circuit 90. In other words, a counter 97 successively counts up and outputs a count value Xi to an encryption device 98. The encryption device 98 encrypts the count value Xi with the key (K). Data Yi that are output from the encryption device 98 are a pseudo random sequence. Only j bits of the data Yi are supplied to an EXOR circuit 96. The EXOR circuit 96 exclusively ORes the j bits of the data Y1 and the j-bit encrypted text Ci, decrypts the encrypted text Ci, and obtains a plain text Mi.
As described above, in the CFB mode, the OFB mode, and the counter mode, an encrypted text Ci is decrypted by exclusively ORing the same pseudo random number with which the encrypted text Ci was encrypted and the encrypted text Ci. A non-patent document, “Basic Encryption Theory (translated title)”, Douglas R. Stinson, Kohichi Sakurai; Kyoritsu Publishing Company, 1996, describes the foregoing various encryption systems.
In recent years, a digital cinema system has been proposed for movie theaters. In the digital cinema system, picture data as movies are stored in for example a picture server. Picture data are reproduced from the picture server and projected on a screen of a movie theater. According to this system, picture data distributed through for example a network and picture data that are recorded on a record medium such as a large capacity optical disc are supplied to the picture server. The picture data are transmitted form the picture server to a projector through for example a coaxial cable and a picture corresponding to the picture data is projected by the projector to the screen.
Picture data are transmitted as serial digital data according to for example the HD-SDI (High Definition-Serial Data Interface) transmission format from the picture server to the projector. The picture data are transmitted as baseband picture data. The transmission rate of the picture data is for example around 1.5 Gbps (Giga bits per second).
At this point, to prevent picture data from being stolen, the picture data that are output from the picture server are encrypted and the encrypted picture data are transmitted to the projector through for example a coaxial cable. If codes transmitted according to the HD-SDI format are not restricted, HD-SDI encryption/decryption systems according to the foregoing encryption systems can be accomplished. In other words, an encryption circuit is disposed on the picture server side to encrypt output picture data. On the other hand, a decryption circuit corresponding to the encryption circuit is disposed on the projector side. Picture data encrypted by the picture server are transmitted according to the HD-SDI format to the projector through the coaxial cable. The encrypted picture data are decrypted by the decryption circuit on the projector side and restored to baseband picture data.
However, actually, in the HD-SDI, prohibition codes for word synchronization are defined. Thus, the applicant of the present patent application has filed a system that encrypts picture data without generating prohibition codes as Japanese Patent Application No. 2002-135039. In addition, the applicant has filed the related patent applications as Japanese Patent Application Nos. 2002-135079, 2002-135092, 2002-173523, and 2002-349373.
In recent years, HD-SDI picture data encryption/decryption systems have been standardized. As an encryption system, the counter mode described in FIG. 6A and FIG. 6B has been proposed. According to the proposition, 128-bit data as an encryption unit are dividedly used and divided bits are counted by the following three types of counters.    (1) Clock counter that counts up for each clock of the encryption device,    (2) Line counter that counts up for each line of picture data.    (3) Frame counter that counts up for each frame of picture data.
Among these three types of counters, the (1) clock counter is reset for each line that is updated, the (2) line counter is reset for each frame that is updated, and the (3) frame counter is reset when one program of picture data is started. With a combination of a plurality of counters that differ in count periods and reset timings, even if out-of-synchronization takes place or data are lost in a data transmission system, data that are lost, namely data that cannot be decrypted, are as low as data of one line.
In addition, even if the (1) clock counter and the (2) line counter are reset, since the value of the (3) frame counter is updated, the same pseudo random sequence is not repeated.
On the other hand, when the CFB mode described in FIG. 4A and FIG. 4B is used, if a counter were reset at a particular time after startup of a program and then the counter were not reset, it would become very difficult to recover the encryption/decryption circuits from an undesirable event such as the foregoing out-of-synchronization and missing of data. In other words, in the CFB mode, data of which an output of an encryption circuit is successively shifted by a shift register is encrypted by an encryption device with a key (K) and a plain text Mi is encrypted with an output of the encryption device. Thus, if an error takes place while data are being encrypted, until the error does not affect the shift register, data that can be decrypted would not be output. In other words, in the CFB mode, since an encrypted text Ci that is output depends on all the past encrypted text Ci, the encrypted data cannot be decrypted in a short time.
Of course, in the CFB mode, an input of an encryption device can be reset for each frame and/or each line. However, if an input of the encryption device were reset for each frame and/or each line and the input data were full black for a plurality of frames, a pseudo random sequence that is output from the encryption device becomes the same in each frame. This pseudo random sequence conveys a hint to a person who tries to steal picture data transmitted from the picture server and the projector. Thus, such a situation is undesirable on security of encrypted data.
Next, a method of stealing picture data from the foregoing digital cinema system will be described. FIG. 7 schematically shows an example of a system that accomplishes stealing of picture data. Picture data are reproduced and encrypted by a picture server 250. The encrypted picture data are sent as encrypted data to a coaxial cable 251. The encryption system resets a counter for each line and for each frame of picture data, and at the beginning of a program according to the foregoing counter mode to recover the system from a transmission error. A projector 254 side normally receives data from the projector 254 through the coaxial cable 251, decrypts encrypted picture data, and projects the decrypted picture data as baseband picture data to a screen 255.
A stealer of picture data prepares a data steal record/exchange device 252, a video camera 256, and a video data record device 257. The data steal record/exchange device 252 is interposed between the picture server 250 and the projector 254. For example, as shown in FIG. 7, the coaxial cable 251 that has to be connected between the server 250 and the projector 254 is connected to the data steal record/exchange device 252. An output of the data steal record/exchange device 252 is sent to the projector 254 through a coaxial cable 253. The video camera 256 is disposed so as to capture a picture projected on the screen 255. The picture captured by the video camera 256 is supplied to the video data record device 257 and recorded on a record medium such as an optical disc or a magnetic tape.
In such a structure, the stealer operates the data steal record/exchange device 252 to record encrypted data that are output from the encrypted picture server 250 and meta data accompanied by the picture data. The data steal record/exchange device 252 outputs predetermined data instead of encrypted data supplied from the picture server 250 along with the meta data accompanied by the encrypted data. At this point, the stealer does not change the meta data. The predetermined data that the data steal record/exchange device 252 provides is a fixed value that causes a black screen to appear.
The predetermined data and the meta data that are output from the data steal record/exchange device 252 are supplied to the projector 254. The projector 254 decrypts the supplied predetermined data. In other words, if the predetermined data are fixed data that cause a black screen to spear, the predetermined data and a pseudo random number of the decryption circuit are exclusively ORed. Picture data of which the predetermined data and the pseudo random number have been exclusively ORed are projected on the screen 255.
A picture projected on the screen 255 depends on data of which predetermined data for example a fixed value and a pseudo random number of the encryption circuit are calculated. Thus, the picture that is projected on the screen 255 is completely different from the original picture data that are output from the picture server 250. The picture projected on the screen 255 appears as noise. The stealer operates the video camera 256 to capture a picture of the predetermined data projected on the screen 255 and the video data record device 257 to record the picture. With the encrypted data recorded by the data steal record/exchange device 252 and the picture data recorded by the video data record device 257, the original picture data that have not been encrypted can be restored.
In other words, if the projecting performance of the projector 254 and the capturing performance of the video camera 256 were ideal and the encrypted data and the picture data were exclusively ORed, the original picture data of the encrypted data could be restored as a disadvantage of the related art.
In reality, the projector 254 and the video camera 256 that have ideal performances do not exist. Thus, in the foregoing method, the original picture data cannot be accurately restored. However, with imperfect data, when the foregoing calculation is preformed, the original picture data can be reproduced with high probability.
It is known that a particular pixel and the adjacent pixels have high correlation as a property of picture data. With the correlation of adjacent pixels, under such circumstances, the values of pixels that are not accurately reproduced can be obtained. As a result, pseudo random numbers with which the pixels (picture data) have been encrypted can be narrowed down. As a result, the stealer may obtain a hint about decrypting a key (K) with which picture data have been encrypted as a disadvantage of the related art.
On the other hand, if the CFB mode is used to encrypt picture data that are output from the picture server 250, since input data are encrypted by feeding back the encrypted data, even if the same data are successively input, a pseudo random sequence that is output varies. Thus, it is difficult to obtain a hint of a key (K). However, as described above, the CFB mode is weak in recovering the system from a transmission error as a disadvantage thereof. This disadvantage may cause a serious problem when picture data are played in a movie theater.